class ComplianceManager {
private regulations: Map<string, Regulation>;
private controls: Map<string, Control>;
private assessments: ComplianceAssessment[];
constructor() {
this.regulations = new Map();
this.controls = new Map();
this.assessments = [];
this.initializeRegulations();
this.initializeControls();
}
private initializeRegulations() {
this.regulations.set('GDPR', {
name: '通用数据保护条例',
description: '欧盟的数据保护法规',
requirements: [
'数据主体权利保障',
'数据处理合法性',
'数据安全保护',
'数据跨境传输',
'数据泄露通知'
]
});
this.regulations.set('CCPA', {
name: '加州消费者隐私法',
description: '加州的消费者隐私保护法规',
requirements: [
'知情权',
'访问权',
'删除权',
'选择退出权',
'数据泄露通知'
]
});
this.regulations.set('网络安全法', {
name: '中华人民共和国网络安全法',
description: '中国的网络安全法规',
requirements: [
'网络安全等级保护',
'个人信息保护',
'数据安全',
'安全事件报告',
'关键信息基础设施保护'
]
});
}
private initializeControls() {
this.controls.set('ACCESS_CONTROL', {
id: 'ACCESS_CONTROL',
name: '访问控制',
description: '限制对系统和数据的访问',
implementation: '实施基于角色的访问控制',
evidence: '访问控制策略文档'
});
this.controls.set('DATA_ENCRYPTION', {
id: 'DATA_ENCRYPTION',
name: '数据加密',
description: '对敏感数据进行加密',
implementation: '实施AES-256加密',
evidence: '加密配置文档'
});
this.controls.set('AUDIT_LOGS', {
id: 'AUDIT_LOGS',
name: '审计日志',
description: '记录所有关键操作',
implementation: '实施审计日志系统',
evidence: '审计日志记录'
});
this.controls.set('DATA_BACKUP', {
id: 'DATA_BACKUP',
name: '数据备份',
description: '定期备份数据',
implementation: '实施自动化备份策略',
evidence: '备份记录和恢复测试'
});
}
async assessCompliance(regulation: string): Promise<ComplianceAssessment> {
const regulationInfo = this.regulations.get(regulation);
if (!regulationInfo) {
throw new Error(`不支持的法规: ${regulation}`);
}
const assessment: ComplianceAssessment = {
id: this.generateId(),
regulation,
assessedAt: new Date(),
requirements: [],
overallScore: 0,
status: 'in_progress'
};
for (const requirement of regulationInfo.requirements) {
const requirementAssessment = await this.assessRequirement(regulation, requirement);
assessment.requirements.push(requirementAssessment);
}
assessment.overallScore = this.calculateOverallScore(assessment.requirements);
assessment.status = this.calculateAssessmentStatus(assessment.overallScore);
this.assessments.push(assessment);
return assessment;
}
private async assessRequirement(regulation: string, requirement: string): Promise<RequirementAssessment> {
const applicableControls = this.getApplicableControls(regulation, requirement);
const requirementAssessment: RequirementAssessment = {
requirement,
controls: [],
score: 0,
status: 'not_assessed',
findings: [],
recommendations: []
};
for (const control of applicableControls) {
const controlAssessment = await this.assessControl(control);
requirementAssessment.controls.push(controlAssessment);
}
requirementAssessment.score = this.calculateRequirementScore(requirementAssessment.controls);
requirementAssessment.status = this.calculateRequirementStatus(requirementAssessment.score);
requirementAssessment.findings = this.generateFindings(requirementAssessment.controls);
requirementAssessment.recommendations = this.generateRecommendations(requirementAssessment.controls);
return requirementAssessment;
}
private getApplicableControls(regulation: string, requirement: string): Control[] {
return Array.from(this.controls.values());
}
private async assessControl(control: Control): Promise<ControlAssessment> {
const controlAssessment: ControlAssessment = {
controlId: control.id,
controlName: control.name,
implementationStatus: 'not_implemented',
effectiveness: 0,
evidence: [],
gaps: []
};
const isImplemented = await this.checkControlImplementation(control);
controlAssessment.implementationStatus = isImplemented ? 'implemented' : 'not_implemented';
controlAssessment.effectiveness = await this.evaluateControlEffectiveness(control);
controlAssessment.evidence = await this.collectEvidence(control);
controlAssessment.gaps = await this.identifyControlGaps(control);
return controlAssessment;
}
private async checkControlImplementation(control: Control): Promise<boolean> {
return true;
}
private async evaluateControlEffectiveness(control: Control): Promise<number> {
return 80;
}
private async collectEvidence(control: Control): Promise<Evidence[]> {
const evidence: Evidence[] = [];
evidence.push({
type: 'documentation',
description: `控制措施 ${control.name} 的实施文档`,
collectedAt: new Date()
});
evidence.push({
type: 'testing',
description: `控制措施 ${control.name} 的测试结果`,
collectedAt: new Date()
});
return evidence;
}
private async identifyControlGaps(control: Control): Promise<Gap[]> {
const gaps: Gap[] = [];
gaps.push({
type: 'implementation',
description: `控制措施 ${control.name} 实施不完整`,
severity: 'medium'
});
return gaps;
}
private calculateOverallScore(requirements: RequirementAssessment[]): number {
if (requirements.length === 0) return 0;
const totalScore = requirements.reduce((sum, req) => sum + req.score, 0);
return Math.round((totalScore / requirements.length) * 100) / 100;
}
private calculateRequirementScore(controls: ControlAssessment[]): number {
if (controls.length === 0) return 0;
const totalScore = controls.reduce((sum, control) =>
sum + (control.implementationStatus === 'implemented' ? control.effectiveness : 0), 0);
return Math.round((totalScore / controls.length) * 100) / 100;
}
private calculateAssessmentStatus(score: number): string {
if (score >= 0.9) return 'compliant';
if (score >= 0.7) return 'mostly_compliant';
if (score >= 0.5) return 'partially_compliant';
return 'non_compliant';
}
private calculateRequirementStatus(score: number): string {
if (score >= 0.9) return 'met';
if (score >= 0.7) return 'mostly_met';
if (score >= 0.5) return 'partially_met';
return 'not_met';
}
private generateFindings(controls: ControlAssessment[]): Finding[] {
const findings: Finding[] = [];
controls.forEach(control => {
control.gaps.forEach(gap => {
findings.push({
controlId: control.controlId,
controlName: control.controlName,
gap,
severity: gap.severity,
description: `控制措施 ${control.controlName} 存在${gap.type}类型的差距`
});
});
});
return findings;
}
private generateRecommendations(controls: ControlAssessment[]): Recommendation[] {
const recommendations: Recommendation[] = [];
controls.forEach(control => {
control.gaps.forEach(gap => {
recommendations.push({
controlId: control.controlId,
controlName: control.controlName,
gap,
action: `修复控制措施 ${control.controlName} 的${gap.type}差距`,
timeline: '30天内',
responsibility: 'IT安全团队'
});
});
});
return recommendations;
}
async generateComplianceReport(regulation: string): Promise<ComplianceReport> {
const assessment = this.assessments.find(a => a.regulation === regulation);
if (!assessment) {
throw new Error(`未找到法规 ${regulation} 的评估结果`);
}
const report: ComplianceReport = {
id: this.generateId(),
regulation,
generatedAt: new Date(),
assessment,
executiveSummary: this.generateExecutiveSummary(assessment),
detailedFindings: assessment.requirements,
recommendations: this.generateRecommendations(assessment.requirements),
actionPlan: this.generateActionPlan(assessment),
appendices: this.generateAppendices(assessment)
};
return report;
}
private generateExecutiveSummary(assessment: ComplianceAssessment): string {
const statusText = {
'compliant': '完全合规',
'mostly_compliant': '基本合规',
'partially_compliant': '部分合规',
'non_compliant': '不合规'
};
return `
法规合规性评估报告执行摘要：
- 法规：${assessment.regulation}
- 评估时间：${assessment.assessedAt.toLocaleDateString()}
- 整体状态：${statusText[assessment.status]}（评分：${(assessment.overallScore * 100).toFixed(1)}%）
- 评估要求：${assessment.requirements.length}项
- 主要发现：
1. 已完全实现的要求：${assessment.requirements.filter(r => r.status === 'met').length}项
2. 部分实现的要求：${assessment.requirements.filter(r => r.status === 'mostly_met' || r.status === 'partially_met').length}项
3. 未实现的要求：${assessment.requirements.filter(r => r.status === 'not_met').length}项
建议优先解决未实现和部分实现的要求，以提高整体合规性。
`.trim();
}
private generateActionPlan(assessment: ComplianceAssessment): ActionPlan {
const actionItems: ActionItem[] = [];
assessment.requirements.forEach(requirement => {
requirement.findings.forEach(finding => {
actionItems.push({
id: this.generateId(),
requirement: requirement.requirement,
finding: finding.description,
action: `修复${finding.controlName}的${finding.gap.type}差距`,
priority: this.calculatePriority(finding.severity),
estimatedEffort: this.estimateEffort(finding.severity),
assignee: this.assignResponsibleParty(finding.severity),
dueDate: this.calculateDueDate(finding.severity)
});
});
});
return {
planId: this.generateId(),
assessmentId: assessment.id,
status: 'draft',
actionItems,
createdAt: new Date()
};
}
private calculatePriority(severity: string): string {
const priorityMap = {
'high': '高',
'medium': '中',
'low': '低'
};
return priorityMap[severity] || '中';
}
private estimateEffort(severity: string): string {
const effortMap = {
'high': '2-4周',
'medium': '1-2周',
'low': '1周内'
};
return effortMap[severity] || '1-2周';
}
private assignResponsibleParty(severity: string): string {
const assigneeMap = {
'high': '信息安全部门',
'medium': 'IT部门',
'low': '业务部门'
};
return assigneeMap[severity] || 'IT部门';
}
private calculateDueDate(severity: string): Date {
const days = {
'high': 30,
'medium': 60,
'low': 90
};
const daysToAdd = days[severity] || 60;
const dueDate = new Date();
dueDate.setDate(dueDate.getDate() + daysToAdd);
return dueDate;
}
private generateAppendices(assessment: ComplianceAssessment): Appendix[] {
return [
{
title: '证据清单',
content: this.generateEvidenceList(assessment.requirements)
},
{
title: '控制措施评估详情',
content: this.generateControlAssessmentDetails(assessment.requirements)
},
{
title: '相关法规条款',
content: this.generateRegulationClauses(assessment.regulation)
}
];
}
private generateEvidenceList(requirements: RequirementAssessment[]): string {
let evidenceList = '证据清单：\n\n';
requirements.forEach(req => {
evidenceList += `要求：${req.requirement}\n`;
req.controls.forEach(control => {
control.evidence.forEach(evidence => {
evidenceList += `- ${evidence.description}\n`;
});
});
evidenceList += '\n';
});
return evidenceList;
}
private generateControlAssessmentDetails(requirements: RequirementAssessment[]): string {
let details = '控制措施评估详情：\n\n';
requirements.forEach(req => {
details += `要求：${req.requirement}\n`;
req.controls.forEach(control => {
details += `- 控制措施：${control.controlName}\n`;
details += ` 实施状态：${control.implementationStatus}\n`;
details += ` 有效性：${control.effectiveness}%\n`;
details += ` 差距：${control.gaps.map(g => g.description).join(', ')}\n\n`;
});
});
return details;
}
private generateRegulationClauses(regulation: string): string {
const regulationInfo = this.regulations.get(regulation);
if (!regulationInfo) {
return '未找到相关法规信息';
}
return `法规名称：${regulationInfo.name}\n\n` +
`法规描述：${regulationInfo.description}\n\n` +
`相关要求：\n` +
regulationInfo.requirements.map(req => `- ${req}`).join('\n');
}
}
|
微信
